By default sessions are cookie based. The only shared knowledge the servers need is the secret_key configured on the endpoint. Everything is sent to the client and back. That’s at least the case unless you switched to a different session implementation.
